View online: https://www.drupal.org/sa-contrib-2023-006

Project: Better Social Sharing Buttons [1] Date: 2023-March-01 Security risk: *Less critical* 8∕25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting

Description:  This module enables you to add social sharing buttons to a site.

The module doesn't sufficiently sanitize the weight and ratio values entered in the module or block configuration.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Solution:  Install the latest version:

* If you use the Better Social Sharing Buttons module for Drupal 9 or 10, upgrade to Better Social Sharing Buttons 4.0.3 [3]

Reported By:  * cydave [4]

Fixed By:  * cydave [5] * Shelane French [6]

Coordinated By:  * Damien McKenna [7] of the Drupal Security Team

[1] https://www.drupal.org/project/better_social_sharing_buttons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/better_social_sharing_buttons/releases/4.0.3 [4] https://www.drupal.org/user/3751740 [5] https://www.drupal.org/user/3751740 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/108450